Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I’m doing a security audit on a fairly large php application and was wondering where I should include my user-input validation.
Should I validate the data, then send the clean data off to the back-end functions or should I rely on each function to do it’s own validation? Or even both?
Is there any standard or best-practice for this sort of thing?
Currently the app does both inconsistently and I’ll like to make things more consistent.
You should definitely validate the data from the outside as soon as possible. Depending on the architecture, backend validation inside the responsible functions can be a second step, but don’t depend on backend validation but validate the data when it comes in to your application.
The pros with validation inside functions as a complement to the previous validation is that it’s easier (and safer) to maintain the system because (sloppier) developers after you can’t break the application. If you have an application with plugin support, e.g. for third party plugins, safe functions is a must also.